Selective virtualization for security threat detection

Patent metadata

Field	Value
Publication number	US-10417031-B2
Application number	US-201615081775-A
Country	US
Kind code	B2
Filing date	Mar 25, 2016
Priority date	Mar 31, 2015
Publication date	Sep 17, 2019
Grant date	Sep 17, 2019

Abstract

Selective virtualization of resources is provided, where the resources may be intercepted and services or the resources may be intercepted and redirected. Virtualization logic monitors for a first plurality of requests that are initiated during processing of an object within the virtual machine. Each of the first plurality of requests, such as system calls for example, is associated with an activity to be performed in connection with one or more resources. The virtualization logic selectively virtualizes resources associated with a second plurality of requests that are initiated during the processing of the object within the virtual machine, where the second plurality of requests is lesser in number than the first plurality of requests.

First claim

What is claimed is:

1. A computerized method comprising:
configuring a virtual machine running within a platform with a first virtualization logic;
monitoring, by the first virtualization logic, for a first plurality of requests that are initiated during processing of an object within the virtual machine, each of the first plurality of requests is associated with an activity to be performed in connection with one or more resources; and
selectively virtualizing, by the first virtualization logic, resources associated with a second plurality of requests that are initiated during the processing of the object within the virtual machine, wherein the second plurality of requests being lesser in number than the first plurality of requests and the selectively virtualizing of the resources comprises
intercepting a first request of the second plurality of requests,
redirecting the first request of the second plurality of requests, the redirecting of the first request comprises generating a modified first request by changing a resource associated with the first request and subsequently passing the modified first request to system code for processing, and
receiving virtualized data in response to passing the modified first request to the system code.

2. The computerized method of claim 1 , wherein the configuring of the virtual machine further comprises providing the first virtualization logic with access to configuration data, the configuration data comprises one or more interception points that are used for intercepting at least the first request of the second plurality of requests.

3. The computerized method of claim 2 , wherein the one or more interception points comprise an Application Programming Interface (API) hook.

4. The computerized method of claim 2 , wherein the configuration data further comprises at least one usage pattern that specifies a particular resource for virtualization and activities for conducting the virtualization, the particular resource corresponding to the first request that is part of the second plurality of requests.

5. The computerized method of claim 1 , wherein the selectively virtualizing of the resources associated with at least the first request of the second plurality of requests further comprises
servicing, by the first virtualization logic, a virtualized resource associated with a second request of the first plurality of requests by returning virtualized data to a process or a thread operating within the virtual machine that initiated the second request.

6. The computerized method of claim 5 , wherein the virtualized data associated with the second request comprises a handle.

7. The computerized method of claim 5 , wherein the resource associated with the first request is accessible via a path to a first address in a virtual memory of the platform and a resource associated with the modified first request comprises an alternative path to a second address in the virtual memory of the platform, the second address in the virtual memory being different from the first address in the virtual memory.

8. The computerized method of claim 1 , wherein the second plurality of requests is a subset of the first plurality of requests.

9. The computerized method of claim 8 , wherein the first virtualization logic is implemented in a user mode of the virtual machine.

10. The computerized method of claim 8 further comprising:
obfuscating, by the first virtualization logic, the virtualized resources associated with the first request of the second plurality of requests by removing a portion of the virtualized data prior to returning the virtualized data to a process or a thread operating within the virtual machine that initiated the first request.

11. The computerized method of claim 9 further comprising:
configuring the virtual machine running within the platform with a second virtualization logic that is implemented within a kernel mode of the virtual machine; and
selectively virtualizing, by the second virtualization logic, resources associated with a third plurality of requests that are initiated during the processing of the object within the virtual machine, where the third plurality of requests being lesser in number than the first plurality of requests and different from the second plurality of requests.

12. The computerized method of claim 11 , wherein the second virtualization logic is responsible for selectively conducting virtualization to the resources associated with the third plurality of requests that are handled in the kernel mode of the virtual machine, the third plurality of requests being a subset of the first plurality of requests.

13. The computerized method of claim 12 , wherein at least one request of the third plurality of requests includes either (i) a request directed to file management, including opening a file or closing a file, or (ii) a request directed to registry key management, including obtaining a registry key value.

14. The computerized method of claim 12 , wherein the third plurality of requests includes one or more requests directed to network management, including establishing a network connection.

15. The computerized method of claim 1 , wherein the virtualizing of the resources associated with the second plurality of requests includes transparently modifying access to at least one or more of the resources by one or one processes operating within the virtual machine.

16. The computerized method of claim 1 , wherein the selectively virtualizing of the resources associated with at least the first request of the second plurality of requests further comprises
obfuscating at least a portion of the virtualized data prior to returning the virtualized data to a process or thread operating within the virtual machine that initiated the first request.

17. The computerized method of claim 16 , wherein the obfuscating includes performance of at least one of (i) preventing a display of certain information directed to a resource of the one or more resources, (ii) altering certain information associated with the resource so that it appears to be present in a platform represented by the virtual machine, or (iii) renaming the resource.

18. The computerized method of claim 1 , wherein the selectively virtualizing of the resources associated with the second plurality of requests being a subset of the first plurality of requests further comprises
redirecting a second request of the second plurality of requests by subsequently passing the second request to the system code for processing;
receiving data in response to passing the second request to the system code; and
servicing, by the first virtualization logic, a virtualized resource associated with the second request of the second plurality of requests by returning virtualized data in lieu of the received data to a process or a thread operating within the virtual machine that initiated the second request.

19. A computerized method for configuring a virtual machine to selectively conduct virtualization of one or more resources during analysis of an object for malware, the computerized method comprising:
configuring the virtual machine running within a platform with a first virtualization logic that is configured with access to a first configuration data, the first configuration data comprises (i) information that is used by the first virtualization logic to identify and subsequently intercept at least a first request that, when processed, performs an activity on a first resource, and (ii) one or more usage patterns including information to determine w

Assignees

• Fireeye Inc

Inventors

• Paithane Sushant
• Vincent Michael

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title